Network Segmentation with VLANs and Firewalls
A company wants guest Wi-Fi to reach only the internet, employee laptops to reach internal apps, and payment servers to remain isolated from both. What is the best design approach?
Quick Answer
The answer is to use separate network segments with firewall rules between guest, employee, and payment zones. This design is correct because network segmentation with VLANs and firewall isolation enforces strict traffic control: guest Wi-Fi is restricted to internet-only access, employee laptops reach internal apps, and payment servers remain completely isolated from both, adhering to the principle of least privilege. On the Security+ SY0-701 exam, this scenario tests your understanding of how VLANs create logical separation at Layer 2 while firewalls enforce policy at Layer 3/4, a common domain 3 objective. A frequent trap is assuming a single firewall or a single VLAN can handle all three zones without proper rule sets—segmentation requires both logical separation and explicit deny-by-default rules. Memory tip: think “three zones, three rules—guest out, employee in, payment no.”
⚠ Common exam trap
It's easy for candidates to think a VPN provides isolation, but a VPN only encrypts traffic and does not inherently segment networks; without separate firewall rules, all VPN clients share the same network access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use separate network segments with firewall rules between guest, employee, and payment zones.
Network segmentation using separate VLANs or subnets with firewall rules enforces isolation between guest Wi-Fi, employee laptops, and payment servers. This design ensures that guest traffic can only reach the internet, employee traffic can access internal apps, and payment servers are completely isolated from both, meeting the principle of least privilege and reducing the attack surface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all systems on one flat network and rely on antivirus.
Why it's wrong here
This keeps devices in the same trust zone, which increases lateral movement risk.
- ✓
Use separate network segments with firewall rules between guest, employee, and payment zones.
Why this is correct
This is the best choice because segmentation limits what each group can reach and reduces the impact of a compromise. Guest users are confined to internet access, employee systems can be limited to approved internal services, and payment servers can be placed in a tightly controlled zone with only required ports open. That design supports least privilege at the network layer and makes monitoring and containment easier.
- ✗
Put all systems behind a single VPN so every device is treated the same.
Why it's wrong here
A VPN does not separate traffic by trust level once inside the network.
- ✗
Use a larger internet circuit so the payment servers are harder to attack.
Why it's wrong here
More bandwidth does not create isolation or enforce access restrictions between network groups.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Network segmentation
Network segmentation is the practice of dividing a computer network into smaller, isolated parts to improve performance, contain security threats, and simplify management.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants guest laptops on Wi-Fi to reach the internet, but not internal file servers or printers. Which two changes best support that design? Select two.
easy- ✓ A.Place guest devices in a separate VLAN or subnet from employee devices.
- ✓ B.Add ACL or firewall rules that block guest traffic from reaching internal private networks.
- C.Put guests on the same VLAN as employees and rely on stronger Wi-Fi passwords.
- D.Disable SSID broadcast so guests cannot discover the network name.
- E.Allow guest devices to use the same DHCP scope as internal endpoints.
Why A: Placing guest devices in a separate VLAN or subnet (Option A) is a fundamental network segmentation technique that isolates guest traffic from the internal corporate network at Layer 2 and Layer 3. This ensures that guest laptops cannot directly communicate with internal file servers or printers unless explicitly routed, and it allows the administrator to apply distinct security policies to the guest subnet. Adding ACL or firewall rules (Option B) is also necessary to explicitly block guest traffic from reaching internal private networks, enforcing the separation at the network layer. Together, these two changes ensure guests can reach the internet while being prevented from accessing internal resources.
Variation 2. A company is implementing network segmentation to isolate the guest wireless network from the internal corporate network. Which of the following technologies is most appropriate to enforce this separation at Layer 2?
medium- ✓ A.VLANs
- B.ACLs
- C.DMZ
- D.VPN
Why A: VLANs (Virtual Local Area Networks) are the correct technology because they operate at Layer 2 (Data Link layer) of the OSI model, allowing network administrators to logically segment a physical switch into multiple isolated broadcast domains. By assigning the guest wireless network to a separate VLAN (e.g., VLAN 100) and the internal corporate network to another (e.g., VLAN 10), traffic between them is blocked at Layer 2 unless explicitly routed through a Layer 3 device with appropriate firewall rules. This directly enforces separation without requiring additional hardware, making VLANs the most appropriate and efficient choice for isolating guest traffic at Layer 2.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.